Which cookies Shopify sets now, and which need consent

Shopify's own storefront cookies now fall into three groups: _shopify_essential, cart and localization keep the store working, _shopify_analytics measures visits and _shopify_marketing carries marketing data, the last two for up to a year. Only the first group is exempt from consent in the EU and UK. As of October 2026, the older _shopify_y and _shopify_s are gone: Shopify stopped setting them on 1 January 2026. Apps and pixels add their own cookies on top, and those need consent too.

The distinction matters because privacy rules treat these categories very differently, and getting it wrong can be expensive. On 1 September 2025 the French CNIL fined SHEIN 150 million euros for placing advertising cookies on visitors' devices before they had made any choice on its banner.

What a Shopify cookie is and who sets it

Shopify cookies are small text files that the Shopify platform stores in a visitor's browser when they interact with a store built on Shopify. They remember what a customer added to the cart, keep a checkout secure, measure visits and support advertising.

Shopify sets some of these cookies itself (first-party cookies tied to your store's domain), while others come from third-party services added to your store, such as Google Analytics 4, Meta Pixel or TikTok Pixel. Shopify's cookie policy, last updated on 9 October 2026, lists its own storefront cookies by name, category and lifetime. It names the third-party tools it uses but not their cookies.

Types of cookies on a Shopify store

The cookies on a Shopify store fall into four broad categories: strictly necessary, functional, analytics and marketing. Each category carries different consent requirements under the GDPR, the ePrivacy Directive and the CCPA.

Strictly necessary cookies

These cookies are essential for the store to function. Without them, visitors could not add products to a cart, proceed through checkout or keep a secure session. Shopify now bundles most of this work into one cookie, _shopify_essential, which its policy describes as covering session, checkout and anti-tampering functions, next to cart, cart_currency, localization and shopify_pay.

Because they are required for the service the visitor explicitly requested, strictly necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive. You do not need to ask permission before setting them, but you still need to disclose them in your cookie policy.

Functional cookies

Functional cookies remember preferences such as language, currency or region. On Shopify, the country and currency of the cart sit in localization and cart_currency, which Shopify files under necessary because the cart cannot work without them. Apps that remember other choices, such as a wishlist or a recently viewed list, often set functional cookies of their own.

The consent position on functional cookies is nuanced. If a preference cookie stores a choice the visitor actively made, some regulators accept that it falls under the "strictly necessary" exemption. Others disagree. The cautious approach is to ask for valid consent for functional cookies unless they are genuinely indispensable.

Analytics and performance cookies

Shopify's own analytics cookie is now _shopify_analytics, kept for one year and used for analytics on the storefront and at checkout. Third-party analytics cookies come from external providers, most commonly Google Analytics 4, which sets only _ga and _ga_<container-id> to measure how visitors use your store. You can look up any of them in the cookie database.

Under the GDPR and the ePrivacy Directive, analytics cookies need prior consent. The CNIL offers a narrow exemption for audience measurement tools that meet strict conditions (no cross-site tracking, limited retention, aggregated reporting only), but a standard GA4 setup does not qualify.

Marketing and advertising cookies

Marketing cookies follow visitors to build profiles for targeted advertising. Shopify itself now sets one on storefronts: _shopify_marketing, kept for one year, which its policy lists under marketing for the storefront and checkout. Most other marketing cookies come from Meta Pixel (_fbp, _fbc), Google Ads, TikTok and Pinterest, installed through sales channels, apps or custom pixels.

All of them need explicit, informed consent before they are set for visitors in the EU and UK. In California the model is different: an opt-out from selling or sharing, covered below.

Shopify cookie names and what they do

The table below lists the cookies most stores show today, from Shopify's own policy for the Shopify rows, with the category Shopify gives them.

This is not exhaustive. Every app you install may add more cookies, so a scan of your own storefront is the only reliable way to get a complete inventory.

The cookies Shopify retired, and what replaced them

Many guides, and many cookie banners, still list _shopify_y, _shopify_s, _shopify_sa_t and _shopify_sa_p. Shopify's developer changelog announced in August 2025 that it would stop setting _shopify_y and _shopify_s on storefronts from 1 January 2026. _shopify_y was a persistent visitor identifier and _shopify_s a 30-minute session identifier, and both were analytics cookies that needed consent.

_shopify_sa_t and _shopify_sa_p were short-lived Shopify analytics cookies tied to referral and page-view data, including where a visit came from. Neither appears on Shopify's current cookie policy. Their job now sits with _shopify_analytics and _shopify_marketing, which is why your scan results and your cookie policy should show the new names.

For developers, the changelog points apps that read _shopify_y to the clientId that Web Pixels events carry, and gives no replacement for the _shopify_s session value.

Does your Shopify store need cookie consent?

Almost certainly. If your store is open to visitors in the EU, UK, Brazil or several US states, at least one privacy law applies that requires consent, or an opt-out, for non-essential cookies.

Under the GDPR and the ePrivacy Directive, any cookie that is not strictly necessary needs prior, informed, freely given consent. That includes Shopify's own _shopify_analytics and _shopify_marketing, not only third-party trackers.

The CCPA takes a different approach. It does not require opt-in consent for cookies, but it does require that you tell visitors about data collection and offer a clear "Do Not Sell or Share My Personal Information" choice if cookies share personal data with third parties for advertising.

In practice, most stores use an opt-in cookie consent banner for EU and UK visitors and an opt-out for California visitors. Shopify's own consent tools follow the same region-based approach.

Shopify's built-in privacy tools

Shopify provides a Customer Privacy API that handles consent signals for Shopify-managed surfaces such as pixels. A banner records a choice with setTrackingConsent, which takes four signals: analytics, marketing, preferences and sale_of_data. Shopify's own tracking then follows those signals.

For Google Consent Mode v2, Shopify's help centre says event data from EEA visitors is not used for personalised advertising unless Consent Mode v2 is active and valid consent is obtained, and that a third-party banner should be connected to Shopify's customer privacy settings. A custom web pixel needs its own Consent Mode snippet.

Shopify's native cookie banner lives under Settings > Customer privacy > Cookie banner. It can show on storefront, cart, checkout and customer account pages in the regions you choose. Shopify's help page says it governs Shopify's own cookies and Shopify Pixels, and that cookies from apps or manually installed pixels may need a third-party banner or custom logic.

Five habits that keep a Shopify cookie setup accurate

Audit your cookies regularly

Shopify apps add and remove cookies often, and Shopify itself renamed its core cookies in 2026. Run a scan every time you install or remove an app, change themes or add a tracking pixel.

Block non-essential scripts before consent

A consent banner does nothing if analytics and marketing scripts fire before the visitor selects "Accept". This was SHEIN's mistake: advertising cookies were placed the moment a visitor landed on the site, before any choice. Use Shopify's Customer Privacy API for Shopify's own tracking, and a consent tool that holds third-party scripts until consent is recorded.

Match your banner to the rules

A banner must give visitors a genuine choice. Under the GDPR, rejecting cookies must be as easy as accepting them. Pre-ticked boxes and "accept-only" banners do not give valid consent, and the CNIL's 2025 decisions included banners whose refusal did not stop cookies from being set.

Maintain a cookie policy

Your store needs a public cookie policy listing every cookie by name, purpose, first-party or third-party status and duration. Shopify publishes the policy for its own cookies, but not one for your store's apps. Update yours whenever a scan finds new names.

Handle cross-border rules

Shopify stores often sell internationally. A visitor from Germany falls under the GDPR and the TDDDG. A visitor from California falls under the CCPA as amended by the CPRA. Visitors in Brazil are covered by the LGPD. Geo-detection with region-specific consent rules lets one store show each visitor the right banner.

What ignoring cookie consent can cost a store

GDPR fines can reach 20 million euros or 4% of global annual turnover, whichever is higher. The ePrivacy Directive, applied through national laws, carries its own penalties. The CNIL issued 83 sanctions totalling 486,839,500 euros in 2025, according to its annual summary, and 21 of the organisations sanctioned had breached the rules on trackers.

Smaller stores should not assume they fly under the radar. 67 of those 83 CNIL sanctions came through its simplified procedure, which is built for faster, smaller cases.

Beyond fines, a missing or misleading banner tells privacy-conscious shoppers that a store does not take their data seriously. For the checkout and pixel side of the same problem, read the guide to Shopify checkout pixels and consent, and for the platform overview see Kukie.io for Shopify.

Questions about Shopify cookies

See which cookies your Shopify store sets today

If your cookie policy still lists _shopify_y, it was written before 2026. The Cookie scanner loads your storefront and lists every cookie it finds by name and category, so you can compare the result with your banner and your policy.

Scan your website